CloudLabBox
Try the free demo

CCIE Enterprise Infrastructure practice lab 7 of 8

Security services and automation

Harden and instrument an IOS XE edge router: AAA with fallback, CoPP tested under a real flood, uRPF, SNMPv3, config-change logging, Flexible NetFlow, IP SLA with tracked failover on a brownout that routing can't see, hierarchical QoS, packet tracing, and automation with YAML, Jinja, NETCONF, RESTCONF, EEM, guest shell Python and telemetry. A 3 to 4 hour practice lab.

Run this lab

It needs Standard: its 6 nodes are set to 7 vCPU and 7,168 MB in total.

In your workspace: Shared, then CCIE Enterprise Infrastructure practice guided labs, then 07 - Security services and automation

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 7,168 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 240 minutes
Nodes need
7 vCPU, 7,168 MB
Smallest plan
Standard

The scenario

Halden Freight's auditors have visited. EDGE, a CSR 1000v, is the router between the management LAN, the core and an outside connection, and it has almost nothing on it. TOOLS is the operations server. Fix everything the audit raised, on real traffic: TOOLS runs a steady stream of web requests and marked pings to BR all the time.

   TOOLS 10.7.1.10 ---- EDGE ---- CORE ---- BR  LAN 10.7.30.0/24
    AAA, syslog,         |  \               /     web on TCP 80
    NetFlow, scripts     |   +--- ALT -----+
                        ATT  outside, not trusted
WhatDesign
OSPFEDGE, CORE, ALT and BR are in area 0, in the start-up configuration. CORE is the preferred path.
TOOLS servicesTACACS+ key Tac-Key-2026, syslog on UDP 514, NetFlow on UDP 2055, telemetry listener on TCP 57500. Logs are in /var/log/lab/.
TACACS+ usersalice / Alice-Pass1, privilege 15. bob / Bob-Pass1, privilege 1.
Local break-glass usernetadmin / Netadmin-2026, privilege 15
SNMPv3User nms, authentication SHA Nms-Auth-2026, privacy AES-128 Nms-Priv-2026
Scripts on TOOLS/root/lab/try_ssh.py, /root/lab/fallback.sh, /root/lab/branches.yaml, /root/lab/collector.py
ATT203.0.113.2. Has a spoofing address on Loopback66, 10.7.30.66.
BR webTCP 80. An HTTP 401 is a working answer.
Fault in placeWeb requests from TOOLS to BR fail today. Nobody knows why.

Addressing

DeviceInterfaceAddressConnects to
TOOLSeth010.7.1.10/24, 2001:db8:7:1::10/64EDGE Gi1
EDGELo010.255.7.1/32, 2001:db8:255:7::1/128
EDGEGi110.7.1.1/24, 2001:db8:7:1::1/64TOOLS eth0
EDGEGi210.7.12.1/30, 2001:db8:7:12::1/64CORE Gi0/0
EDGEGi310.7.13.1/30, 2001:db8:7:13::1/64ALT Gi0/0
EDGEGi4203.0.113.1/30, 2001:db8:7:4::1/64ATT Gi0/0
EDGEVirtualPortGroup0192.168.35.1/24
CORELo010.255.7.2/32, 2001:db8:255:7::2/128
COREGi0/010.7.12.2/30, 2001:db8:7:12::2/64EDGE Gi2
COREGi0/110.7.23.1/30, 2001:db8:7:23::1/64BR Gi0/0
ALTLo010.255.7.3/32, 2001:db8:255:7::3/128
ALTGi0/010.7.13.2/30, 2001:db8:7:13::2/64EDGE Gi3
ALTGi0/110.7.34.1/30, 2001:db8:7:34::1/64BR Gi0/1
BRLo010.255.7.4/32, 2001:db8:255:7::4/128
BRLo1010.7.30.1/24, 2001:db8:7:30::1/64
BRGi0/010.7.23.2/30, 2001:db8:7:23::2/64CORE Gi0/1
BRGi0/110.7.34.2/30, 2001:db8:7:34::2/64ALT Gi0/1
ATTLo0198.18.7.1/24, 2001:db8:7:66::1/64
ATTLo6610.7.30.66/32
ATTGi0/0203.0.113.2/30, 2001:db8:7:4::2/64EDGE Gi4

Rules for the whole lab

  • ATT, CORE's ACL and BR's web server are outside your control, though CORE and BR take the small changes the tasks name.
  • The console of every router must keep working with no login, whatever happens to TACACS+.
  • Don't remove the LAB-FAIL-* applets or stop TOOLS' traffic script.

What you’ll practise

  • Secure management with TACACS+, a tested fallback, and control plane policing
  • Filter and validate traffic with ACLs, IPv6 filters and uRPF
  • Build visibility with SNMPv3, syslog, configuration logging and Flexible NetFlow
  • Use IP SLA, track lists and EEM to catch a failure that routing can't see
  • Build hierarchical QoS with NBAR, marking and a trust boundary
  • Find a fault with packet tracing, conditional debugging and embedded capture
  • Automate with Jinja2, YAML, NETCONF, RESTCONF, guest shell Python and telemetry

The tasks

  • Section 1: Management and the control plane (18 points)
  • Section 2: Traffic filtering (12 points)
  • Section 3: Visibility (16 points)
  • Section 4: Paths that lie (14 points)
  • Section 5: Quality of service (12 points)
  • Section 6: Fault finding with the tools on the box (10 points)
  • Section 7: Automation (18 points)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Security services and automation6 nodes, 6 links. Every link is listed as text below the diagram.TOOLSEDGECOREALTBRATTGi4Gi0/0eth0Gi1Gi2Gi0/0Gi3Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • TOOLS eth0 to EDGE Gi1
  • EDGE Gi2 to CORE Gi0/0
  • EDGE Gi3 to ALT Gi0/0
  • EDGE Gi4 to ATT Gi0/0
  • CORE Gi0/1 to BR Gi0/0
  • ALT Gi0/1 to BR Gi0/1
Nodes in Security services and automation, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
TOOLSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
EDGECisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial2 vCPU, 4,096 MB
CORECisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ALTCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BRCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ATTCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCIE Enterprise Infrastructure practice guided labs.

  3. Open 07 - Security services and automation and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCIE Enterprise Infrastructure practice labs

All CCIE Enterprise Infrastructure practice labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.